# US 2019/0171816 A1 · Feature vector aggregation for malware detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0171816 A1 - Document ID: US20190171816A1 - Status: Published application - Kind: A1 - Application number: 15/832,832 - Filed: 2017-12-06 - Published: 2019-06-06 - Earliest claimed: 2017-12-06 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Fady Copty; Cynthia Eisner; Dov Murik; Tamer Salman - Web page: https://patentgrep.com/patent/US20190171816A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method, apparatus and product performing feature vector aggregation for malware detection. Two sets of measurements produced by a two dynamic analyses of an examined program are obtained, wherein the two dynamic analyses are performed with respect to the examined program executing two different execution paths. An aggregated feature vector representing the examined program is generated. The aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements. A predictive model is applied on the aggregated feature vector to classify the examined program as malicious or benign. ## Claims ### Claim 1 A method comprising: obtaining a first set of measurements produced by a first dynamic analysis of an examined program, wherein the first dynamic analysis is performed with respect to the examined program executing a first execution path; obtaining a second set of measurements produced by a second dynamic analysis of the examined program, wherein the second dynamic analysis is performed with respect to the examined program executing a second execution path, wherein the first and second execution paths are different; generating an aggregated feature vector representing the examined program, wherein the aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements; and applying a predictive model on the aggregated feature vector to classify the examined program as malicious or benign. ### Claim 2 (depends on 1) The method of claim 1 further comprises performing the first dynamic analysis and the second dynamic analysis. ### Claim 3 (depends on 1) The method of claim 1 further comprises training the predictive model, wherein said training comprises: performing multiple dynamic analysis on each labeled program in a training set, wherein the training set comprises labeled programs, wherein each labeled program is labeled as malicious or benign, wherein labeled programs having a malicious label exhibit malicious functionality in a subset of execution paths thereof; generating for each labeled program the aggregated feature vector, whereby obtaining labeled aggregated feature vectors; and training the predictive model using the labeled aggregated feature vectors. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of aggregated features comprises an aggregated Uniform Resource Identifier (URI) feature, wherein the aggregated URI feature comprises a list of all URIs contacted by the examined program in any of the execution paths. ### Claim 5 (depends on 1) The method of claim 1, wherein the set of aggregated features comprises an aggregated created file feature, wherein the aggregated created file feature comprises a list of all files created by the examined program in any of the execution paths. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of aggregated features comprises an aggregated functionality count feature, wherein the aggregated functionality count feature comprises a count of a number utilizations of a functionality identified in all of the execution paths. ### Claim 7 (depends on 6) The method of claim 6, wherein the functionality is an anti-debug pattern. ### Claim 8 (depends on 6) The method of claim 6, wherein the functionality is an invocation of an Application Programming Interface (API) function of an Operating System (OS) or of an hardware instruction. ### Claim 9 (depends on 1) The method of claim 1, wherein the set of aggregated features comprises an aggregated memory entropy feature, wherein the aggregated memory entropy feature indicates an aggregated entropy of dynamically created memory during execution in all of the execution paths. ### Claim 10 (depends on 1) The method of claim 1, wherein the set of aggregated features comprises a maximal string deviation feature, wherein the maximal string deviation feature comprises a maximal deviation of strings that are dynamically created during execution in all of the execution paths. ### Claim 11 A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising: obtaining a first set of measurements produced by a first dynamic analysis of an examined program, wherein the first dynamic analysis is performed with respect to the examined program executing a first execution path; obtaining a second set of measurements produced by a second dynamic analysis of the examined program, wherein the second dynamic analysis is performed with respect to the examined program executing a second execution path, wherein the first and second execution paths are different; generating an aggregated feature vector representing the examined program, wherein the aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements; and applying a predictive model on the aggregated feature vector to classify the examined program as malicious or benign. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the method further comprises performing the first dynamic analysis and the second dynamic analysis. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein the method further comprises training the predictive model, wherein said training comprises: performing multiple dynamic analysis on each labeled program in a training set, wherein the training set comprises labeled programs, wherein each labeled program is labeled as malicious or benign, wherein labeled programs having a malicious label exhibit malicious functionality in a subset of execution paths thereof; generating for each labeled program the aggregated feature vector, whereby obtaining labeled aggregated feature vectors; and training the predictive model using the labeled aggregated feature vectors. ### Claim 14 (depends on 11) The computer program product of claim 11, wherein the set of aggregated features comprises an aggregated Uniform Resource Identifier (URI) feature, wherein the aggregated URI feature comprises a list of all URIs contacted by the examined program in any of the execution paths. ### Claim 15 (depends on 11) The computer program product of claim 11, wherein the set of aggregated features comprises an aggregated created file feature, wherein the aggregated created file feature comprises a list of all files created by the examined program in any of the execution paths. ### Claim 16 (depends on 11) The computer program product of claim 11, wherein the set of aggregated features comprises an aggregated functionality count feature, wherein the aggregated functionality count feature comprises a count of a number utilizations of a functionality identified in all of the execution paths. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the functionality is selected from the group consisting of an anti-debug pattern, an invocation of an Application Programming Interface (API) function of an Operating System (OS) or of an hardware instruction. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein the set of aggregated features comprises an aggregated memory entropy feature, wherein the aggregated memory entropy feature indicates an aggregated entropy of dynamically created memory during execution in all of the execution paths. ### Claim 19 (depends on 11) The computer program product of claim 11, wherein the set of aggregated features comprises a maximal string deviation feature, wherein the maximal string deviation feature comprises a maximal deviation of strings that are dynamically created during execution in all of the execution paths. ### Claim 20 A computerized apparatus having a processor, the processor being adapted to perform the steps of: obtaining a first set of measurements produced by a first dynamic analysis of an examined program, wherein the first dynamic analysis is performed with respect to the examined program executing a first execution path; obtaining a second set of measurements produced by a second dynamic analysis of the examined program, wherein the second dynamic analysis is performed with respect to the examined program executing a second execution path, wherein the first and second execution paths are different; generating an aggregated feature vector representing the examined program, wherein the aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements; and applying a predictive model on the aggregated feature vector to classify the examined program as malicious or benign.